MDL-64003 core_message: Use sql_like_escape() in message_search_users

2018-12-11 11:52:18 +01:00
parent 44890bd738
commit f8b46dabe8
1 changed files with 1 additions and 1 deletions
@@ -309,7 +309,7 @@ class api {
        $excludeusers = array($userid, $CFG->siteguest);
        list($exclude, $excludeparams) = $DB->get_in_or_equal($excludeusers, SQL_PARAMS_NAMED, 'param', false);

-        $params = array('search' => '%' . $search . '%', 'userid1' => $userid, 'userid2' => $userid);
+        $params = array('search' => '%' . $DB->sql_like_escape($search) . '%', 'userid1' => $userid, 'userid2' => $userid);

        // Ok, let's search for contacts first.
        $sql = "SELECT u.id